Validation API should always happen on master (bug 946369)

(API-Pinning is only enabled for authenticated users, but this
 API is available to anonymous users as well)